Files that outlived the chats that held them, and a page that led with its footnotes

The second audit pass. Four things, and the first two were reported.

The Prompts page put a screen of variables and a screen of preview above
the editor, so the tabs began two screens down and switching one had to
drag the whole page to be any use -- and on a short tab it could not drag
far enough, leaving the panel stranded above a screenful of nothing.
Editor first, reference after, bar sticky. Custom themes were three fixed
slots: fifty-seven empty colour boxes on a fresh instance and no way to
make a fourth theme. One block per theme plus a blank one, colours behind
a disclosure. Both measured rather than argued about -- rendered through
TestClient and driven under headless Chromium, where the tab bar moved
385->642px before and does not move now, and the themes page went from
5495px to 2820px.

Asking where generated images go found the other two. Deleting a chat
cascades to the attachment rows and leaves every file on disk; the helper
written for exactly that was called from one place, and it was not the
delete button, a schedule's chat, a helper's chat or deleting an account.
Underneath it, `claim` bound message_id and never chat_id, so anything
picked before a chat existed kept an empty chat_id forever -- which six
readers filter on, so those files were also unnamed in the prompt,
unopenable in the canvas, and invisible to the one caller the cleanup had.

And folders nest now. The route has handled parent_id since folders
existed, with a cycle guard and a depth cap the move path never applied;
the sidebar has always drawn a tree. Nothing could ask for one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/services/chat.py

@@ -621,6 +621,37 @@ async def summarise_for_compaction(
     return raw.strip()
 
 
+def delete_chats(db: DBSession, chats) -> int:
+    """Delete chats, and the files their attachments point at.
+
+    **The one way to delete a chat.** `db.delete(chat)` cascades to its messages
+    and to its attachment *rows*, and leaves every file on disk -- a generated
+    image, an uploaded PDF, a photo -- with nothing that will ever look at them
+    again: `sweep_orphans` only considers uploads that were never attached.
+
+    `files_service.remove_files_for_chats` was written for exactly this and was
+    called from one place, the temporary sweep. The delete button, a schedule's
+    task chat, a helper's hidden chat and deleting an account all went straight
+    to `db.delete`, so four of the five ways a chat can end leaked its files.
+    That is `sharing.forget_principal` again: a helper that exists, is correct,
+    and is not called on the path that needs it.
+
+    The order matters and is why this is a function rather than a note. The
+    files have to be unlinked **while the rows still say which they are**, so it
+    happens before the delete and in the same session.
+
+    Does not commit -- the caller decides, because some of them are deleting
+    other things in the same transaction.
+    """
+    live = [chat for chat in chats if chat is not None]
+    if not live:
+        return 0
+    files_service.remove_files_for_chats(db, [chat.id for chat in live])
+    for chat in live:
+        db.delete(chat)
+    return len(live)
+
+
 def sweep_temporary(db: DBSession, older_than: timedelta = TEMPORARY_LIFETIME) -> int:
     """Delete temporary chats nobody has touched for a day.
 
@@ -652,9 +683,7 @@ def sweep_temporary(db: DBSession, older_than: timedelta = TEMPORARY_LIFETIME) -
     if not stale:
         return 0
 
-    files_service.remove_files_for_chats(db, [chat.id for chat in stale])
-    for chat in stale:
-        db.delete(chat)
+    delete_chats(db, stale)
     db.commit()
     log.info("swept %d temporary chat(s)", len(stale))
     return len(stale)